CVE-2026-93141

usb: gadget: r8a66597: avoid double free of ep0_req in probe error path

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: r8a66597: avoid double free of ep0_req in probe error path

If usb_add_gadget_udc() fails, r8a66597_probe() jumps to err_add_udc and frees ep0_req, then falls through to clean_up2 where ep0_req is freed again when it is non-NULL.

Remove the redundant free from err_add_udc and keep the cleanup in clean_up2 so the request is released exactly once.

Issue found using a prototype static analysis tool and confirmed by code review.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	776976a67ae25d18be42794fd783a50757402cbe to before c9e93290ffe7db22a8131a5f5fd026335090fbbeAffected 776976a67ae25d18be42794fd783a50757402cbe to before 7721cf32efa428bd9649f4a9b89fc85601df87deAffected 776976a67ae25d18be42794fd783a50757402cbe to before f9c43246128a2dd0f2bbad71decf153910ce3606Affected 776976a67ae25d18be42794fd783a50757402cbe to before 150d3f3c461345b6c9ae784912cf1e49c8e5ff6bAffected 776976a67ae25d18be42794fd783a50757402cbe to before b2e68583c7c51eea2aafb8f1793e0d285c56ac82Affected 776976a67ae25d18be42794fd783a50757402cbe to before 6648c470918371766f6d368113dd2a4faebac93fAffected 776976a67ae25d18be42794fd783a50757402cbe to before 6be64cca6527f7fc99b05abf54f22db91bbc116fAffected 776976a67ae25d18be42794fd783a50757402cbe to before 41d541e3718db01668a4cd29815ee4b3b55f76d2Affected
LinuxLinux	3.17Affected before 3.17Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

776976a67ae25d18be42794fd783a50757402cbe to before c9e93290ffe7db22a8131a5f5fd026335090fbbeAffected
776976a67ae25d18be42794fd783a50757402cbe to before 7721cf32efa428bd9649f4a9b89fc85601df87deAffected
776976a67ae25d18be42794fd783a50757402cbe to before f9c43246128a2dd0f2bbad71decf153910ce3606Affected
776976a67ae25d18be42794fd783a50757402cbe to before 150d3f3c461345b6c9ae784912cf1e49c8e5ff6bAffected
776976a67ae25d18be42794fd783a50757402cbe to before b2e68583c7c51eea2aafb8f1793e0d285c56ac82Affected
776976a67ae25d18be42794fd783a50757402cbe to before 6648c470918371766f6d368113dd2a4faebac93fAffected
776976a67ae25d18be42794fd783a50757402cbe to before 6be64cca6527f7fc99b05abf54f22db91bbc116fAffected
776976a67ae25d18be42794fd783a50757402cbe to before 41d541e3718db01668a4cd29815ee4b3b55f76d2Affected

LinuxLinux

3.17Affected
before 3.17Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.